Infection virus heur trojan win32 generic

Résolu
Bonjour,
J'ai été infecté par virus heur trojan win32 generic. Je tente en vain des analyses avec dc web cureit mais l'examen echoue : mon pc reboot au milieu de l'analyse.
Aidez moi s'il vous plait.
J'attends impatiemment votre réponse
Merci d'avance
Configuration: Windows Vista Internet Explorer 7.0

58 réponses

Résumé de la discussion

Une infection par le cheval de Troie Win32 Generic provoque des redémarrages du système en cours d’analyse, rendant les outils d’éradication comme CureIt inopérants et nécessitant une approche de désinfection plus robuste. Des propositions de solution incluent l’utilisation d’outils alternatifs et des procédures en plusieurs étapes, notamment téléchargement sécurisé d’outils externes, exécution en mode administrateur, puis génération et analyse d’un rapport avant suppression. Plusieurs conseils ont été partagés, tels que sauvegarder les données personnelles avant toute intervention, éviter les formats de fuite et recueillir des rapports détaillés (HiJackThis, TCleaner) pour orienter le nettoyage. En dernier lieu, GMER a été utilisé pour repérer des éléments malveillants persistants et la discussion a évolué vers une approche collaborative et pédagogique.

Bobot (l’IA à votre service)
  1. Contributeur sécurité
    Re,

    OK, tu as bien fait.

    On continue comme ça :

    * Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.

    http://pc-system.fr/
    hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
    hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

    * Clique droit et exécuter en tant qu'administrateur.

    * Clique sur Recherche et laisse le scan se terminer.

    * Clique, sur Suppression pour finaliser.

    * Tu peux, si tu le souhaites, te servir des Options facultatives.

    * Clique sur Quitter, pour que le rapport puisse se créer.

    * Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

    53
    1. Salut télécharge et installe Hijackthis fait un rapport et envoie le ...
      http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe
      0
      1. Merci pour votre réponse, voilà mon hijackthis

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 08:19:17, on 26/08/2009
        Platform: Windows Vista SP1 (WinNT 6.00.1905)
        MSIE: Internet Explorer v8.00 (8.00.6001.18813)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\taskeng.exe
        C:\Windows\system32\Dwm.exe
        C:\Windows\Explorer.EXE
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\Windows\RtHDVCpl.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
        C:\Program Files\Launch Manager\LManager.exe
        C:\Windows\System32\mobsync.exe
        C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
        C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
        C:\Program Files\Windows Live\Family Safety\fsui.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Windows\ehome\ehtray.exe
        C:\Windows\System32\p2phost.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Garmin\ANT Agent\ANT Agent.exe
        C:\Program Files\Nosibay\VPbubble\Launcher.exe
        C:\Program Files\Windows Media Player\wmpnscfg.exe
        C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
        C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
        C:\Windows\ehome\ehmsas.exe
        C:\Windows\System32\rundll32.exe
        C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
        C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Users\MARC\AppData\Local\Temp\RtkBtMnt.exe
        C:\Program Files\Nosibay\VPbubble\VPbubble.exe
        C:\Program Files\Windows Live\Contacts\wlcomm.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Windows Live\Toolbar\wltuser.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Users\MARC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XY5MJ0JW\HiJackThis[1].exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
        O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
        O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
        O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
        O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
        O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
        O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
        O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
        O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
        O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
        O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
        O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
        O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
        O4 - HKCU\..\Run: [ANT Agent] C:\Garmin\ANT Agent\ANT Agent.exe
        O4 - HKCU\..\Run: [VPbubble] "C:\Program Files\Nosibay\VPbubble\launcher.exe"
        O4 - HKCU\..\Run: [SystemExplorer] C:\windows\system\explorer.exe
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
        O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
        O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
        O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/VistaMSNPUpldfr-fr.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
        O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
        O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
        O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
        O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
        O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
        O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
        O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: Service Google Update (gupdate1ca0791a68fd045) (gupdate1ca0791a68fd045) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
        O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
        O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
        O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
        O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
        O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio.exe (file missing)
        1
        1. Télécharge et installe Toolbar S&D
          Fait un rapport en t'aidant de ceci et envoie le ..
          Supprime les Toolbar ...

          Bonne chance !

          Jocker's
          0
          1. -----------\\ ToolBar S&D 1.2.9 XP/Vista

            Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
            X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-52 )
            BIOS : PhoenixBIOS 4.0 Release 6.1
            USER : MARC ( Administrator )
            BOOT : Normal boot
            C:\ (Local Disk) - NTFS - Total:70 Go (Free:6 Go)
            D:\ (Local Disk) - NTFS - Total:70 Go (Free:53 Go)
            E:\ (CD or DVD)

            "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
            Option : [1] ( 26/08/2009|22:14 )

            [ UAC => 1 ]

            -----------\\ Recherche de Fichiers / Dossiers ...

            -----------\\ [..\Internet Explorer\Main]

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            "Local Page"="C:\\Windows\\system32\\blank.htm"
            "Start Page"="http://neufportail.fr/"
            "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
            "Url"="https://www.msn.com/fr-fr/actualite/"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            "Start Page"="https://fr.yahoo.com/"
            "Default_Page_URL"="https://fr.yahoo.com/"
            "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
            "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
            "Local Page"="C:\\Windows\\System32\\blank.htm"

            --------------------\\ Recherche d'autres infections

            --------------------\\ Cracks & Keygens ..

            C:\Users\MARC\AppData\Roaming\uTorrent\F-Secure Client Security v7.10 + Keygen (Multi).torrent
            C:\Users\MARC\AppData\Roaming\uTorrent\Kaspersky2009Keygenerator.exe.torrent
            C:\Users\MARC\AppData\Roaming\uTorrent\Kaspersky_KeyGen.zip.torrent
            C:\Users\MARC\AppData\Roaming\uTorrent\Nero 9.2.5.0+Keygen_lefbruno.torrent
            C:\Users\MARC\AppData\Roaming\uTorrent\Nero 9.2.6.0 Activator CRACK.rar.torrent
            C:\Users\MARC\AppData\Roaming\uTorrent\Sony Vegas Pro 9 + Crack and KeyGen!.EXE.torrent
            C:\Users\MARC\Desktop\karaok‚\Mon disque\Neil Diamond - Cracklin Rose.kar
            C:\Users\MARC\Desktop\karaok‚\Mon disque\Zap\Cracklin' Rose (Neil Diamond).kar
            C:\Users\MARC\Documents\Lavalys.EVEREST.Ultimate.Edition.v4.60.1500.Multilingual.Incl.Keygen-BRD.rar
            C:\Users\MARC\Documents\WinRAR_keygen.exe

            [ UAC => 1 ]

            1 - "C:\ToolBar SD\TB_1.txt" - 26/08/2009|22:30 - Option : [1]

            -----------\\ Fin du rapport a 22:30:54,74
            0
            1. Punéez j'ai oublier de te dire qu'il fallait désactiver l'Uac sous Vista
              alors désactive le et refait un rapport .. Toolbar S&D
              0
              1. Tu veux me lâcher un peu les baquettes ...
                0
                1. J'ai pas envie de faire une formation mais d'apprendre grâce au Topic ...
                  0
                  1. Voilà le rapport

                    ========== COMMANDS ==========

                    [EMPTYTEMP]

                    User: All Users

                    User: Default
                    ->Temp folder emptied: 0 bytes
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
                    ->Temporary Internet Files folder emptied: 33170 bytes

                    User: Default User
                    ->Temp folder emptied: 0 bytes
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
                    ->Temporary Internet Files folder emptied: 33170 bytes

                    User: MARC
                    ->Temp folder emptied: 115433978 bytes
                    ->Temporary Internet Files folder emptied: 264689179 bytes
                    ->Google Chrome cache emptied: 0 bytes

                    User: Public

                    %systemdrive% .tmp files removed: 0 bytes
                    %systemroot% .tmp files removed: 0 bytes
                    %systemroot%\System32 .tmp files removed: 0 bytes
                    Windows Temp folder emptied: 0 bytes
                    RecycleBin emptied: 0 bytes

                    Total Files Cleaned = 362,58 mb

                    OTM by OldTimer - Version 3.0.0.6 log created on 08302009_222517

                    Files moved on Reboot...
                    File move failed. c:\windows\system\explorer.exe scheduled to be moved on reboot.
                    File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
                    File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.

                    Registry entries deleted on Reboot...
                    0
                    1. Contributeur sécurité
                      tu as bien pris tout le rapport, car normalement il aurait du me mettre les fichiers.
                      0
                      1. Je te donne tout ce que j ai eu :
                        All processes killed
                        ========== REGISTRY ==========
                        Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SystemExplorer deleted successfully.
                        ========== FILES ==========
                        File move failed. c:\windows\system\explorer.exe scheduled to be moved on reboot.
                        ========== COMMANDS ==========

                        [EMPTYTEMP]

                        User: All Users

                        User: Default
                        ->Temp folder emptied: 0 bytes
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
                        ->Temporary Internet Files folder emptied: 33170 bytes

                        User: Default User
                        ->Temp folder emptied: 0 bytes
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                        File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
                        ->Temporary Internet Files folder emptied: 33170 bytes

                        User: MARC
                        ->Temp folder emptied: 115433978 bytes
                        ->Temporary Internet Files folder emptied: 264689179 bytes
                        ->Google Chrome cache emptied: 0 bytes

                        User: Public

                        %systemdrive% .tmp files removed: 0 bytes
                        %systemroot% .tmp files removed: 0 bytes
                        %systemroot%\System32 .tmp files removed: 0 bytes
                        Windows Temp folder emptied: 0 bytes
                        RecycleBin emptied: 0 bytes

                        Total Files Cleaned = 362,58 mb

                        OTM by OldTimer - Version 3.0.0.6 log created on 08302009_222517

                        Files moved on Reboot...
                        File move failed. c:\windows\system\explorer.exe scheduled to be moved on reboot.
                        File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7GLZQ2P\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FHGYJUFD\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTPD44YJ\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52T17CE0\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
                        File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.

                        Registry entries deleted on Reboot...
                        0
                        1. J'avais pris une version d'AVG pour règler mon problème. Cà avait marché une fois alors g pensé que çà remarcherait. Mais je l'avais désinstallé dès que j'ai commencé la procédure de désinfection avec toi
                          0
                          1. Voilà plus aucun fichier avg
                            J'ai lancé une recherche de fichier AVG et rien n a été trouvé
                            Par contre j ai du supprimer des fichiers avg dans REGEDIT
                            0
                            1. Merci helpeur59 sa fait plaisirs xD ! apparemment Pimprenelle est déjà passer par la ..
                              0
                              1. tu es simplement en colère car Colombo t'as cassé, si tu voulais vraiment combattre des noobs qui polluent le forum de virus-sécurité colombo n'est pas le seul helpeur(apparemment il a désinfecté pas mal de gars) jalousie peut-être..(alors que tu apparais dans tous ces messages, c'est personel ça)tu derais commencer par toi même,
                                -1
                                1. Pimprenelle écoute ton Papa helpeur59 ...
                                  -1
                                  1. Merci pour ton aide
                                    L analyse est en cours. Le verdict pour demain.
                                    En attendant bonne nuit et merci encore
                                    0
                                    1. je ne perturbe pas cette discussion,je tiens juste à te dire, que les helpeurs ne sont pas tous obligés de mettre le même caneed que toi... mais moi je ne te qualifirais pas de helpeur,tu fais des gestes enfantins...
                                      52
                                      1. bonjour à toutes à à tous,

                                        juste pour suivre

                                        Message pour ULTIMATEFOUR,
                                        Patience et courage ;-)


                                        bonne continuation à+
                                        0
                                        • 1
                                        • 2
                                        • 3